FR2824975A1 - First/second information connection across telecommunications network having mechanism calling second equipment with digital data base having identification/call recovery connecting equipment across network. - Google Patents

Abstract

The connection system has information equipment (1,2) across a network (3). There is a mechanism of calling the second equipment via a stored telephone number without the need to lift the telephone receiver. The identification of the call and recovery are held in a digital data base (8) connecting the first and second equipment across the telecommunications network.

Description

R _ Dv / G of 1 G of 2 G of m mod n

1 2824975

  The present invention relates to a first connection system

  and second computer equipment through a telecommunications network.

  This equipment is for example formed by microcomputers or remote access servers to information systems which are for example equipped with modems with which telephone numbers are associated.

  These modems can for example be secure modems which

  include a combination formed for example by a configurable key which must be identical for the two modems built into the two devices for

allow connection of these.

  However, these secure modems have a certain number of drawbacks, particularly in terms of their cost, owing to the fact that there is no secure modem for portable microcomputers of the PCMCIA type, nor for portable telephones, difficulties linked to their implementation in the same measure where it is necessary to configure the modem for each calling equipment by indicating the callback number which will be unique compared to the modem of the calling equipment and the possibilities of hacking using a modem

  identical type and key generator.

  There are also in the prior art, automatic call back services for software for remote control of computer equipment.

  as for example "PC ANYWHERE" type software.

  This type of software is fairly secure, but it only allows you to take control of computer equipment. In fact, it allows only one connection at a time on a server or any equipment arranged by

example in a business.

  Another service is also well known in the state of the art, namely the RAS service ("Remote Access Service"). Most systems

  operating systems of remote access servers integrate this functionality.

  This service allows a user who has, for example, a microcomputer with a modem, to dial the call number of a RAS remote access server. This numbering can only be done from the microphone

  computer connected to a landline or mobile phone.

  The RAS server then receives the call and picks up the line.

  This already presents a first drawback insofar as the fact

  picking up the line causes the user to pay for the call.

2 2824975

  Then, the server and the microcomputer exchange identification information, such as for example registration information of the "LOGIN" type and a connection password to define the access privileges.

  to the rest of the information system as well as the telephone number for reporting

  user's pel. This exchange must be done in a fixed time or with a number

maximum attempts.

  If this time has elapsed or if this maximum number of attempts is reached

  communication is disconnected by the server.

  It is during this phase that hacking can take place by usurpation

  identity or intrusion into the server.

  Indeed, such a system can be hacked because there is a connection between the server and the user and certain hacking software can enter and modify the properties of the RAS server and then make the intrusion into the system.

information itself.

  There is indeed in this case no certainty on the origin of

  the user who calls the RAS server.

  The system then remains open to the call of any user, because in all cases, the RAS server picks up the line and gives the invitation to the

user login.

  Once the various identification information has been declared valid, for example from a database and the allocation of access rights and the callback telephone number defined in this database for the user has been completed, connection continues. The RAS server hangs up the line and the user's microcomputer stands by to receive a call. The RAS remote access server then calls back the microcomputer of the user who receives the call and picks up the line, which makes it possible to establish the

  connection between the user and the information system.

  In view of the above, it can be seen that such a connection is not

  not secure and that the information system can be hacked.

  The object of the invention is therefore to solve these problems.

  To this end, the invention relates to a system for connecting first and second computer equipment through a telecommunication network.

3 2824975

  cation, a telephone number being assigned to each of these pieces of equipment,

  characterized in that it includes means for calling the second device,

  which is assigned a telephone number, and in that the second equipment comprises means for recovering the telephone number assigned to the calling means without lifting the line, means for identifying the means of calling and recovering in a database of a telephone number assigned to the first equipment and the means of calling it by this number

  through the telecommunications network, to allow connection.

  The invention will be better understood on reading the description which will

  follow, given only by way of example and made with reference to the appended drawings, in which: - Figs. 1 to 12 represent block diagrams of a system

  connection according to the invention, illustrating on the one hand, the general structure of it

  here and on the other hand, its operation.

  As indicated above, the invention relates to a system for connecting the first and second computer equipment through a telecommunications network, a telephone number being assigned to

each of these pieces of equipment.

  The IT equipment can be of different types and natures and in the example which will be described later, the connection of a microcomputer and an information system, for example of a company, has been illustrated, at

  through a RAS-type remote access server.

  Thus, for example, in these figures, the general reference 1 designates the first equipment, the general reference 2, the second equipment and

  the general reference 3, the telecommunications network 3.

  A telephone number is assigned to each of these devices and

  is established by the operator of the telecommunications network.

  As indicated above, the first item of equipment may for example include a microcomputer designated by the general reference 4 associated with a modem designated by the general reference 5, connected to the telecommunications network. The second device may in turn comprise a remote access server for RAS authentication designated by the general reference 6 associated with a modem designated by the general reference 7 and a designated database

  by the general reference 8, which will be described in more detail below.

  Modem 7 is also connected to the telecommunications network.

  This RAS access server allows for example to have access to an information system of a company, designated by the general reference 9 in these figures. The purpose of the system described is therefore to allow a microcomputer to access, through a telephone operator and a telephone network, an information system, for example of a company, a private network, an Inter access.

  net, etc .., and this in a secure way to facilitate tele-activity.

  For this, it is necessary to implement a security to be sure

  an unknown user does not connect to the information system.

  It is therefore advisable to prevent any impersonation of a user

  to prevent any intrusion into the information system with a view to hacking.

  This is achieved by processing the telephone numbers of different parties, each telephone number being assigned by the operator of the telephone network and being unique and specific to each party connected to the network, whether fixed line or mobile. This number cannot in fact be falsified by the caller or at least not before the called equipment has picked up the line, because it is the operator of the TV network.

  telephone that manages these numbers and the network.

  We will describe below an example of implementation of the system according to the invention in which a user who wishes to have access to an information system such as the system 9, has a micro computer 4 associated with the mo

dem 5.

  During the step illustrated in Figure 1, the user triggers the number

  rotation to the authentication remote access server 6.

  This numbering is done in the example described from the microphone

computer 4.

  Other examples will be described in order to show that the call to the server 6 can also be made by the user from means different from this microcomputer, such as for example from a fixed telephone set or

  mobile associated with the telephone network.

2824975

  As illustrated in FIG. 2, this call is then routed through the telecommunications network 3 to the server and more particularly

modem 7 of it.

  The authentication server and more particularly the modem associated with it then receives this call, but does not pick up the line. This allows on the one hand, to avoid the payment of the communication by the user and on the other hand

  However, keep the telephone number of the calling equipment secret.

  Indeed, if the server picks up, as happens in the state of the art, the telephone number of the calling equipment can be recovered and be usurped by different systems easily accessible in the state of the art. During the step illustrated in FIG. 3, the telephone number of the calling equipment is retrieved by the remote access server 6 through its

  modem 7 and this, always without picking up the line, in the conventional way.

  During the step illustrated in FIG. 4, the remote access server 6 identifies the call means by comparing the telephone number retrieved with information contained in the database 8, the latter storing information relating to a table of authorized users and to one or more numbers of

  pre-registered phone that are associated with these.

  This makes it possible to check the validity of the access of a calling user.

  During the phase illustrated in FIG. 5, the call originating from the user is interrupted for example after a predetermined period of time

  finished or a predetermined number of x rings.

  The first equipment, that is to say the first microcomputer

  made available to the user, is then awaiting receipt of a call.

  During the step illustrated in FIG. 6, the user is declared valid by the remote access server 6 and a call back telephone number associated with this user is retrieved by the access server 6 in the database 8, from the corresponding table, in order to trigger the recall of the first equipment. It is thus understood that this callback is made from a telephone number stored for a user identified in the database associated with the server. It will be noted that this process makes it possible on the one hand, to call only identified equipment and validated users and on the other hand, this user to use for example a telephone equipment different from the first team

  computer to call the server.

  This other telephone equipment can then be assigned a telephone number different from the first computer equipment which should be

connect to the server.

  The telephone number of the calling equipment is therefore only retrieved by the RAS server for access validation and user identification questions and is not used as a callback number for the pre

computer equipment.

  Of course, these telephone numbers can be identical if the user has called the server from the microcomputer that the ser

later must call back.

  During the step illustrated in FIG. 7, the access server triggers the

  recall of the user through the telephone network thanks to his modem.

  During the step illustrated in FIG. 8, the first equipment receives

  the call from the server and pick up the line.

  During the step illustrated in FIG. 9, means for exchanging information of conventional type between the items of equipment are activated to allow the server to request the user a certain number of identification information and to authentication, such as registration information such as "LOGIN> 'and a login password for challenge

  Define the privileges of access to the information system.

  During the steps illustrated in FIGS. 10 and 11, the user enters this various information in the microcomputer and it is transmitted to

  through the telecommunications network to the server.

  It should be noted that this must for example be carried out within a predetermined period of time or with a maximum number of attempts before switching off.

  communication by the RAS server.

  Once this information has been collected at the remote access server 6, the latter checks this information by comparing it, for example, to corresponding information in the database 8 and by assigning rights

  defined in this database for this user.

7 2824975

  This allows as is illustrated in Figure 12, to establish the connection between the first and second equipment, that is to say between the microphone

  computer and information system.

  It goes without saying of course that still other embodiments of this system can be envisaged. It is thus, as indicated above, that the call to the server can be made by the user by implementing a piece of equipment.

  different from the first device to be connected.

  This equipment can, for example, be a landline telephone or a mobile telephone enabling the remote access server to be activated and bringing it, after verification, to use a callback telephone number stored in the

  database to recall the first computer equipment.

  Such a structure has a number of advantages including

  connection security.

  Indeed, you must first know the telephone number of the ser

remote access value.

  The telephone number retrieved, i.e. the one corresponding to the calling equipment, cannot be falsified before the line is picked up, because

  the allocation of this is made by the operator of the telephone network.

  If the telephone number of the calling equipment is hidden, the remote access server cannot react, because this number is essential for it

  to access the database.

  There cannot be an intrusion for hacking into the user base of the remote access server, because this server does not pick up the line. There is therefore no connection between the user and the server during this authentication phase. This remote access server recalls a predefined user number

  and that is stored in the database.

  It is therefore understandable that even if a user has managed to impersonate someone else, the server only recalls the number which is in the database and not the one presented to him during the call. This makes it possible to offer multiple possibilities of calling for authentication, for example from a mobile telephone and call back from the server on an associated fixed telephone line.

at the first equipment.

  An additional level of security is introduced with authentication information, for example the password, to give access to the remote information system according to the access privileges defined beforehand in

the user database.

  Adding a predetermined time delay for entering this identification information also avoids the possibility of multiple tests of different combinations, for example by implementing a logi

adequate hacking sky.

  This can also be achieved by limiting the number of attempts

information entry.

  Finally, the use of a virtual private network can also add

core to security.

  Indeed, the telephone operator can set up a virtual private network with a numbering based on a number of digits different from

the one used in the public.

Claims (5)

  1. Connection system for first and second computer equipment (1,2) through a telecommunications network (3), a telephone number being assigned to each of these equipment, characterized in that it carries means (1) for calling the second device, to which a telephone number is assigned, and in that the second device (2) comprises means (6,7) for recovering the telephone number assigned to the call means without picking up the line, means (6,8) for identifying the means of calling and retrieving in a database (8) a telephone number assigned to the first equipment (1) and means (6,7 ) call it by this number through the telecommunications network, to allow connection. 2. System according to claim 1, characterized in that the   means of call are formed by the first equipment (1).   3. System according to claim 1, characterized in that the calling means are formed by telephone equipment separate from the first team   ment (1) and connected to the telephone network (3).   4. System according to any one of the preceding claims,   characterized in that the first and second equipment (1,2) comprise means (4,5,6,7,8) for exchanging information identifying the user of the first equipment (1).   5. System according to any one of the preceding claims,   characterized in that the first equipment comprises a microcomputer (4) equipped with a modem (5) and the second equipment comprises an access server